d7ca09fb50b3b99f149ec2adb796a3bcab98ff78c1e12a10bb83c1ca517e7672

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 14:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
Size 3.6MB
Sample260803-r1ageaba59
SHA256 d7ca09fb50b3b99f149ec2adb796a3bcab98ff78c1e12a10bb83c1ca517e7672
MD5 5d62c4149b05dd46ee641d20fd651328
SHA1 24a002d75abb78a355ac0f1616bc8fd10b8e691d
SHA512 fbb6834e7ddf96da45c6e53fb59f0462822b51bcfc60c2ab55f51b3726e760941a36056d9a504f21d80ed137907200dc460ceda9aaec997823861ed3a5d856e9
SSDEEP 49152:H1o1D7iKzUfjpNG4h7iuxTc7RDpK7WkAbJa5gUmCmIZDgNWT30UNJqu1ZOWXaQ/q:2nCG4h7FiRA7WkAbJbrCmIZDjNJp3Lm
TLSH
T1D906BF21BDB18427C46303728D6EF67D316DBD642B3481C763CB3A5C39386E15A3A6A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1476	elevation_service.exe
4880	elevation_service.exe
2092	maintenanceservice.exe
5456	OSE.EXE
3084	PerceptionSimulationService.exe
4420	perfhost.exe
4384	ReFsDedupSvc.exe
3016	SensorDataService.exe
3100	ssh-agent.exe
5304	AgentService.exe
3748	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\bf023ac3238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c720f9e45523dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006f00dfe75523dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008b10c8e85523dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1476	elevation_service.exe
1476	elevation_service.exe
1476	elevation_service.exe
1476	elevation_service.exe
1476	elevation_service.exe
1476	elevation_service.exe
1476	elevation_service.exe
4880	elevation_service.exe
4880	elevation_service.exe
4880	elevation_service.exe
4880	elevation_service.exe
4880	elevation_service.exe
4880	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6032	2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
Token: SeBackupPrivilege	4384	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4384	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4384	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4384	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4384	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4384	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4384	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4384	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4384	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4384	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5304	AgentService.exe
Token: 33	3748	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3748	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3748	SearchIndexer.exe
Token: SeDebugPrivilege	1476	elevation_service.exe
Token: SeDebugPrivilege	4880	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6032	2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
6032	2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3748 wrote to memory of 2204	3748	SearchIndexer.exe	99
PID 3748 wrote to memory of 2384	3748	SearchIndexer.exe	100
PID 3748 wrote to memory of 3564	3748	SearchIndexer.exe	101
PID 3748 wrote to memory of 4664	3748	SearchIndexer.exe	102
PID 3748 wrote to memory of 4944	3748	SearchIndexer.exe	104
PID 3748 wrote to memory of 3896	3748	SearchIndexer.exe	105
PID 3748 wrote to memory of 1552	3748	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_5d62c4149b05dd46ee641d20fd651328_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:6032

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1476

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4880

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2092

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5456

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3084

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4420

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4384

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3016

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3100

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5304

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3748
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2204
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2384
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2856 2844 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3564
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2892 2888 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4664
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4944
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2892 2888 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3896
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2856 2844 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 24b420464496872c97725589b94fdc870952e0d4f0f2e44f8cbc3f3ab2a5cdd5
MD5 4a2c6de18da21f995937c82b7c3bbf6e
SHA1 775fa0e9bf6fbcdec3225a30e1d156b03753fb6d
SHA512 975600362af507d5a72658951d5274cb2558c4681fff1ac113c0fa487b46495e2aab172ecd49218ae6cfc5f75f96ced3c8ce921eee2cc5b8628279695ef9879c
SSDEEP 49152:qb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnFQ/lFTjN4:c3q6HjBpLm
TLSH
T13FD58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 0bcaa77ea4060b0f302237c8eda1c851c7b4c7857d974e808d501f8857585fc0
MD5 2d7fe1da940c9914962d611cefa5878a
SHA1 82c4e48d1b491c2270e01567c1f5e7cc30865195
SHA512 95039c3f57e1e886acdfc7da5973994c86df69fd10e2e7ff10faa3e331372e78387d3f3adb6dc1a1f6191995fe5a1902491e1b9667be2a07fa8d055e29aab62c
SSDEEP 12288:D1XLsswWkxy2lRq2czACGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:ZXYfDtczACnQ/tbw/2Mkjy6Fr7g0o+
TLSH
T1A465F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 49989ae90b2ea8715d727f0f2502f4f973f52ac89519482e11fee4aed2056a3a
MD5 c45d171bf9a5281eaecca12d82e95a3f
SHA1 6cebc6e5e63dbaa068c224bdb21cda2aa14a89d4
SHA512 53d91b38da143c27c68c8019c03fcbbcf40a2ccd5c63ceb08adaa7461deb45d8374fdcb6201b9d713ebb50c860626a58094b2ad2e84c2fb90facb72d8a0a5557
SSDEEP 24576:S0Le5ji0hmxLrMdnQ/tbw/2Mkjy6Fr7g0on:SPji0AlQQ/lFTjN4
TLSH
T187859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 811c3f3d8d36739d3e2621853f49808cee1ec1777ba578e2c7266c5acef06d43
MD5 e0a10b5e2e056bbd61c5445d99caaa6d
SHA1 a2b2a41b05dc14e89b2e5f5798aea10ee587de31
SHA512 bf3ec5a948a65849267dd3a2c52c2b5f52a17a3fa812efd6ec4676db084d8f5cd2b9d1e5d8e14f235a42fa0bfa16b0bd91db2bb6e1bcdec390f3388c81146a12
SSDEEP 24576:2a7/ezSC6vUyD/aqgrvWE6q8wyu/nQ/tbw/2Mkjy6Fr7g0o3:B/ezSC6vUzPvxHjyUQ/lFTjN4
TLSH
T1F6755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d1919540cabe37d2db5fa4d62243c2072883cabbc6bfb2e79b36c1e6732d84b3
MD5 a287fde2d2d4fcafaab34e0b96f569a3
SHA1 8fdc9b37b77c7470557487db0a315e9fba000217
SHA512 10fefb7c2c4ab04f770dd3b1671229b234f52623c2d685dd87baccb48cae023198742415b68a3413d4c10c26299e754435cc749f0ebb7acc7b200397e95cee6b
SSDEEP 24576:iVbqPb88hv/l+6enQ/tbw/2Mkjy6Fr7g0oI:iVO88hXl+xQ/lFTjN4
TLSH
T1B8559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 44e5e21501e9d90b8ffeccbc2108dc9851e9d4d5e07ecff3878d1d61e28aeba0
MD5 3653fe7001a4345110c7da9053c4f610
SHA1 979bdbf0b27e381b9ed18da30e20a2e3a91f9d52
SHA512 e75bc15051ada85190706a84dc29bd9531f0332393dc317a0cd94771d5e939a6a03862f97c6966e9ea4f387e725703998080749e300524cb14321a03a03de58e
SSDEEP 12288:qzJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:qzZnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T14D5523796A24F897FF2B06B55CC284826B7B0EC1BFD4A74E6B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 e9d9cef65d82d66f7cd070af092e3b7497a00c6da7471f72dd29ea70978e3e61
MD5 f7a0703a4a2b084b4263cfd23aba2d12
SHA1 228e0ebc89db228c124c0ecacfbb3554ebbcb40a
SHA512 50e44a6e4d9805d41389235d9f5f80fc6b38aa400f5a794c4c2764eb2c8fa43b7991e4ad186974ae5e8ec67254e9bc6aae49eec66adce8b97d3b9cb805e16c27
SSDEEP 12288:4eBNUbTVO86UWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:4JIU2nQ/tbw/2Mkjy6Fr7g0oE
TLSH
T12F75CF3BAE28FCD2C67E4DB85A918600D77278704F61A3CBD164830EDE276E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2d0721944ceead63eb074f019009b4f64cb8559311ae6b7ab4a0c38f12ee69ac
MD5 de55f14d80622c30f64baa446c36f2f7
SHA1 b7d75ae492f2d0688bf8b4fce0f4b9d44a1a5b33
SHA512 6e1c3583972e689fc5cfc66de19ffa17ed16cb76f84e085c8038a4b4a4cd44a987720b7c2091b81c2840d20f83b96cf681c26b7072cae0ed36b0399e8549b72d
SSDEEP 49152:xQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH8:xQvGAdlCEL8c/yRNw5CELm
TLSH
T169267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 6f537e27ca40e44878c155369beeb83130388917f4220e743454c7b04e7c8954
MD5 6bfb0ef51e7c3f2b1bda21bdc6fc8b8c
SHA1 373398f4ebc3091da95e68b1c76b3172e20e70e2
SHA512 c761594eea761a1f5847ef42bc182efc42b45de6d97322c32e287fbba636ceeec6f37c1a6374b13bc6d89f64653327e2a4adbc37dd912993f19f05b3a24d527a
SSDEEP 12288:TAwSfxL/2Dc39DLLmt0LDQewsAjAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgK:MQewsAjgnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T16B75E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a648955dbdbd30102d9176d4821c0555bb67986cfeff581035c470cb4669a7a7
MD5 e939e5395598bd27fae1512976080be0
SHA1 af589f764199f1498321316729ee1ee5012446d4
SHA512 759b21590ea07d5028f4cdf24305e71dc9aea5e752b0c0cde0debcef078ee88acb0eba4cd0a7df74daa3720bb56e25df2e9773209d50a712bc5a6dd3a4323d1d
SSDEEP 196608:RUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHLL:RUEtQevvqc2W1cpV2EI32
TLSH
T12C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 55bcc37fd64470c8d79897c5cf09ea14a8afa3601e6ccffa0d5d4c05d9476def
MD5 6c995bb94c21b062ff2b5de51aa666fb
SHA1 db3cd62aacd88e7f307a4e8df5975d989c2630c1
SHA512 51486499186237089ed164d6904dee798652b874735d0bedeac7628ae1a3389461f39ea62ced9bda4cd718d5e842a3ffe47d50604940c7b68b34ef2c381b3096
SSDEEP 49152:ACbRquA/m2yL5zQfFiV+XenmE3/zAQ/lFTjN4:JoqtVjnmoLm
TLSH
T1DFD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 0900906f6373d0fc5dc9e9820acd418b64c928c82251579390ff54c0b4a98d1d
MD5 772b4d06c174e82a6f77447a94677290
SHA1 9d7643f71389318a8d4ce0011f441744f881a636
SHA512 4ce82bb26cbc2193f79f65cd5513dace7f05b19c450d491cbc79c58614200aeaa9271c08f59c0a4ab6294a4652b0ea3809fa69bdc2f09e330ea1393fc0e42d8e
SSDEEP 24576:IAhGLJIFoiwtA5l7S53jnQ/tbw/2Mkjy6Fr7g0oc:IAMyFoiq5TQ/lFTjN4
TLSH
T15435AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 d87bc5652f7c358431aeee1f40b0c849290456fc3139a9a95f9e0e9b02823e1a
MD5 687ca1354338c8004a9400c25f274d36
SHA1 4cca2c52a53d2ca65f6c0d1f91d125777c435e2a
SHA512 145d498496056c70dfaa53c64865b0ab4c8ff72368727bd8dc4c21bb7b46047b8a0c68bc54b4896f034b501dbd8490a76410a9edb08c8798315e050c8ec8d479
SSDEEP 12288:Mmw5HEjsChN2BFgl0WDm+C/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMF:pwuHOW0nQ/tbw/2Mkjy6Fr7g0og
TLSH
T1EA65F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 286f8418ea425b5f9102265dea6620df4d2f8a7426fef3028e68647ffd71e16f
MD5 34e42896b4b1cd500ef73b29a320fba9
SHA1 f7a0b21fc40c37aed4d370bed61e8f06f29fbd66
SHA512 535ccd8387552630ed2bd114b20f9caed41c763a939a11549b181dcc2f9b08a0e2967f2f784f5947206c403a1b86d6a9c9ebef52892143547255fc622e64e876
SSDEEP 12288:9XZ1IyQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:tZuVnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T13A55126933A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 01a40a01c548a8d2c43c419052df1c9fdae2378ebdf37734bf641f79dcaf19e8
MD5 2e12dae15eb0ccabda2cda192bdd845c
SHA1 6fd182aba5cf4a481e2e37475ab57d5962fe58de
SHA512 5d1814bd13bedcd2c9d5cdb83a0c3e234c920aaa2b0cae0365efd9e4959ea51ba0d435974f6c9e5fe8003feb2f275de679dd30d6ee380d7935d44881c33fdd52
SSDEEP 49152:/j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UQ:OQRQyi36YOcPQLvw2gAf+PN31Lm
TLSH
T17F667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 dd31a2a3277881966341ccea830ce4af3871d4a05e2c3a5391df01f51f8e5f4f
MD5 d2581f51b098cff24d5ca7c6977c6a6b
SHA1 79a645b6fffee0306367bd7e9d7cba8d2068b9a5
SHA512 3c47ff0f74ec291aad14c6cd8e2ccc25c6aa069c1071434039694750bfe82b7ceba5f82a7f610d6efb2eee863a2d6c7704b60dc462d2cf0f6023ce42b077f4d1
SSDEEP 49152:Kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UQ:JQRQyi36YOcPQLvw2gAf+PN31Lm
TLSH
T1FB667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 1253c5d37f0df36ababe00d84f157134cc8390da667676fa33a8dbd9c9ef940c
MD5 7e286c1d570bac67056c1bec1191f714
SHA1 cedff097fbe9c92eb905fd8748872e1c6b7e5899
SHA512 bc3c61f7878dfb9b03e45bddbd30909f6481328ff69f7cb55efdb454994ba3c5649c546e525676c3c3608f5b181b189285cdd620dfa3bc94b979192a9e6505e7
SSDEEP 24576:6wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0FnQ/tbw/2Mkjy6Y:068Qg55nhheWu7PNU3/QQ/lFTjN4
TLSH
T18BB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c6a56863266e83f5bd501ce12dceaf6aec6b12c84871acc7aae9e6d531e52e62
MD5 6aadb9030f5a76d51dfb77dc9d2105ec
SHA1 faa25783a4dfa154db3e64617b5550011fe176c4
SHA512 76fa8cc573afcde75b93c3fc914e7b41373e808ec5929309e9b3d94913732aefcd8a18026d784aa5ea46d8cf05bc87613f9164d4f982404c635c4a85b01be4c5
SSDEEP 49152:c3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99m:Zy5112gYy5azzVvL69nLKnhZOLm
TLSH
T136167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 71a8cdfcacda78a374d80c467f1011ba2903f1129b925173ddb065527f318cab
MD5 ed9ca221a300e9b14e1c254ef164029c
SHA1 525a96ff7daf542ab4b86bbcbb29051a334ce6cf
SHA512 3cff7ecff57deb164e62daaa406a83000a9c1c770785ce7d1d207432123e84721cb6cd8ca3699b429254387d50dd76a683a854799050df25ed0a6eedf34547e1
SSDEEP 49152:yB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glyQ/lFTjN4:Au6JmVxd2d9Lm
TLSH
T141D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 fe0ea50fd1b35b28272c83e3672038a35aeb59c30dab8af150a365351e9cd335
MD5 e032237c1104c5e829b20d0cbae5f54f
SHA1 3d229f66f351c25246aa646f5502949d1b3b85d9
SHA512 9731707ed176d150290d4ce5d93b291894593efb27207178b96ee8c92707b80c0d1fa2bc013321d5383c18ac69ac3a0f28a204b56b62caf63fcfaad8313924af
SSDEEP 49152:F1hpsNoJpF1A6UU44CwH7R4xWQ/lFTjN4:FmifPbRoLm
TLSH
T1E3B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 9270d25abc0de9ab2f8e70e45bcaac31aec95cba8bfb251951378f4f418c9bbe
MD5 71a499c7f89e6aae7a275061ebbba181
SHA1 6db99fabc567cab3a242e33e141dbbb0c8e6f952
SHA512 50c21e179b716cc8a7baff9f41cdfb9da6a135365be35111de17e0d75f7685f7663c85a6370ff001f0e1011f841093935f6b58f0151b45a79431857a041d759c
SSDEEP 49152:pSuZQIY0Be2KRRVtOnks6NMHqVQ/lFTjN4:n5dKTi616Lm
TLSH
T197C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8fb557f30fad680b52887229b727f0e170aea66d5fec50d5c88ef3bbadfe594b
MD5 27dc7627d99b8c047192fad6904eaa0b
SHA1 aec4a969707279c41c3d8f8d95aeda090357e7cd
SHA512 192b6117e0900abf8a800e7d3f8be2bf5295ecb58938f053c78093e1458247b69e23807c8ebc9c676d5fea3035ecbc1e5a035d7180498c2d134841d35138fe95
SSDEEP 49152:ThtSn8EApI0figngiDn0AP5wCQ/lFTjN4:SX2iyphcLm
TLSH
T15295BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 71f66a1687a4dfde4bb8a682c0b374f1e3c9f11a2d6aeaaecef5e01b516d3f97
MD5 fc15a5af2cdf5a7a22a45faed34a8673
SHA1 bfe31a55d02da9db2a61ae1e3dde1f300c25486b
SHA512 fb679f733325d144db64fdfa6238b0c200942c7eddef4b8e257cd81417219364eabdbb3fe39ad65b3ce0efc35c336b903b18df7618be2bc54185b81f80190871
SSDEEP 12288:DhGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:DxnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T1775523697964F98BFB1706F18C828182A73F0EC6BFD1938F77482129967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 8079c3d94782d10ca08d03bdbed1e4325a6916686a2a7dc4398f0123ff252bf1
MD5 2880b6305e89c47445266e6383ed06ad
SHA1 b458f16af047be8a9b91d033c992701aa4ca10c3
SHA512 4816c5dc226bd6d71d64e4f7f52fc8abc326c27c28923a5f0cfeb1b7d48c70028ff8d8ae52751bcc6c73d6b3346ebfbf781f4f114910fd84873257d630fb2dbb
SSDEEP 12288:5cGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:5cnQ/tbw/2Mkjy6Fr7g0og
TLSH
T11C5523697965F98BFB1706F14C8281829B3B0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 f435a666b543615909f0e5175026ba153e5ad85ef0a0b233f49ab546b7119a26
MD5 da7a5193a98945c462acf4bfd1a865be
SHA1 c870515820288f857b8afb28dbe0c34946590e35
SHA512 55d2fc3956937fffeb275042f2d3ede4eab49b94c93606c3696753f96e8edd67055c0ba038ab1102a1660d8372f99774b73462b193486d31fc7d86efa3372cc7
SSDEEP 12288:fOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:fOnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1445523697965F98BFB1706F14C8281829B3B0EC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 90106cbc557fe66fd5a75f247967711c9227bbdf3fccdfbe3c3262a44c670893
MD5 da479516d0bfa4d5401eeef097229934
SHA1 57a6758c8ccd349ec23dd6b42bd42cff83adaf60
SHA512 f9be8bfda3bd61a320799109b6ad54eca417b0dd098361dd9a95ce74a41610128b43bedc2305a2ade2cb52d58a048f262d75e97d93fefe8910aa8c2bfb3f4982
SSDEEP 12288:DVTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:9nQ/tbw/2Mkjy6Fr7g0oL
TLSH
T1F45523693B69F4C7F92742B4CC928142E77B3DC5BBB1A38F6B04111D4E793D419A6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 9758bcb96251ec0bc825f49b616932f8de0c23283cfea34a160b6638f9cb005b
MD5 96b953b939c10d08118f8dda2315a07d
SHA1 253c79b60fa3d33e7019cd5b6e99e63a26bec4d1
SHA512 897eb9a52577d53a41381735903dbb4e72dbc6a80ac23141d62ce1713bac83db052f3ff5f891866d77932a210e9e608d32ff2acd9ce8f77c33ac8123ad069ed6
SSDEEP 12288:5bGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:5LnQ/tbw/2Mkjy6Fr7g0ow
TLSH
T1AE5523697955F98BFB1706F14C8381829B3B0EC6BFD1938F77481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 2dad03401f525bcc3984dfa6d6b612d7a45f6f3c7467ffb761a8266004099686
MD5 dd793cc35d729cc353c1afd4bff89192
SHA1 b8c88216422ee02ff91c7dd983a3d641c37e9305
SHA512 96534086b4a843b4d050a65cfa05e85740026ecca09989dadeb1232f52c7e40c5d3a6b69b4c90a5b28b41545b996690d747248a3808e45ecd510f68b32d89415
SSDEEP 12288:f4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:f4nQ/tbw/2Mkjy6Fr7g0oW
TLSH
T1745523697964F98BFB1706F14C828182A73F0EC6BFD1938F7B482129967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 8ef310cdbbca64752d92a10df52d2816a195b479c65c3c3a387afc13dbbde61b
MD5 87b1ee167a9a72adc206e55ce72a08cd
SHA1 0b60bfe5ad7c0f63bc84dfec91b6bbc800d03db4
SHA512 629a0e221c912678982b55493fa564d13fae7e2c01f15de4d6d0793a63eebc0496c64a260008b3d3edfa6fcf304df224735da2046f00fc64b37d50bd2916863e
SSDEEP 12288:lEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:lknQ/tbw/2Mkjy6Fr7g0oe
TLSH
T1575523797965F98BFB2702F14C8281829B3B0EC6BFD1938F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 86ac797cbeceb02561185286b4e643b1ea3b9f034e1cb6cb94b7f4f8235b4565
MD5 7637c8e2b53a59898ea491c7530ee4f6
SHA1 02e8decedf96c82120d6b4f61066a5c46eaf683f
SHA512 e6fbb9e8c66330cb91d28cc7cca4659f375e71c86f82c58820854ea633abd66e74e81a950fad24b4b1fa6bdea586c969c3df2248649332c1c024643dac845a2c
SSDEEP 12288:siZwbDzzFEoS2cPvy8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:PZM3zFVSO8nQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1697501A9B35058F9EC67427ECC518906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 3f24984b4b6026e3bce601bbdbc25ba6a1174bce4801a02ca35651d5c9a78a4d
MD5 8de4292b53f8e4748de4c018044a8d8d
SHA1 2fedfa95737061de89613647b1746e664ece5bdd
SHA512 72d21ee906ae408d2e4e87fcd77a44d2ae159adfb711f3a1ea3048a7c2a0c9dbfba2c8c1d0da39552036625d5b26e94230860586e6c752e94e9c69805ebedf70
SSDEEP 12288:dFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:dlnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T15D5523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 87f4c440c7e4a621cc749ad9e89d5d6109ca795fb359651c709404ca7836a8fc
MD5 61eacd9c61defc9d29cce3288c9850ef
SHA1 e6df7973573a885018b8d245376162f5ee27face
SHA512 e7d4fc55781fc4ab728b881bbffa46a5edbd5b1656ed9fb5f9da5349e7427f4ab9f34383870abfcd8ae0839bc8032e8bc18942884e0a08e711ff89f4ba52a6e7
SSDEEP 12288:iZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:ipnQ/tbw/2Mkjy6Fr7g0or
TLSH
T1425523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481129967C39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 7bafbd2d729f795ce8f875f11a814e3421b1db926272339312d7cc6af138dc9e
MD5 049aec6373d51c2e28cbdc0b9c16703e
SHA1 ed78f63e2007c6a9ae096e755a359c6d605ade51
SHA512 fa0c656220cde5e3a3b1e8d0794af02af631d30a9c40a14d3e509c06df296a2a12a3cad6dd7701e4f0c49792fa598646da6945266b0f1956c322ce6ce55fb33f
SSDEEP 12288:7yPz5L8QGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:2zywnQ/tbw/2Mkjy6Fr7g0od
TLSH
T1AB65021B73A570FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 3755e95dd033e1f35d99f783d65145a1ce310f663517b37e527cf186481f7021
MD5 4d42c69f5a2a73a9dd2779b2dbf6534e
SHA1 443c11b08b3bb081b52254050d3b54b187fa5ca8
SHA512 34e78e2665c180300ec3aeb1bcd84cd81e6cdcbb28b2ec25279cc102fe32b6749113d7e23040516e0d2c9749e84bf41f273b86110a072c43c88cb1633e496a4f
SSDEEP 12288:cFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:clnQ/tbw/2Mkjy6Fr7g0ov
TLSH
T1595523697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 68c1718a29d1ec003597d6549f9d8c8e2c936fe214d29d2b6b6d03e12b1d3782
MD5 3ec9739cf95700f15a00e8c63554e943
SHA1 862f3fc13aa2a11f80cd111d0f2b05d6b928a6b4
SHA512 692b06afb256f8c7167236a78d61c214f911d5bd6c03817cac73068fccf79de1a638ba6c1ab505705e259a1f75c16c4bba29cb58a9eaa813e9d4ee767a67a022
SSDEEP 12288:oFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:olnQ/tbw/2Mkjy6Fr7g0ov
TLSH
T1D25523697925F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 f9e0644fcd12cf6ee17292ce0cacdf80ea0ae42eb35e97d2fc4246c042f7497a
MD5 f524c389afec7ea6a0fb49404ae48c5c
SHA1 7b38a25cd65cdfd1bb1e31d743512db68909b333
SHA512 ffd9e6a6a4f29a2c5df5e3c370d5eda813748ed5f77ce0d435849f7e885e4b22237cc8bdd576e17880606ee86e9706e29693cbccca71df6e099faf026e07e0c6
SSDEEP 12288:oyPz5L8QGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:pzywnQ/tbw/2Mkjy6Fr7g0oI
TLSH
T15165021B77A170FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 6ff9c3303b05da7ba95e7a0ef8f29891b855a820773cfcdaa7f335735eacca44
MD5 e9035017fcd17b67b3630e468a9d295d
SHA1 a784009b7dc99d6278336c6de090c84a4856830d
SHA512 c966e0ff46f60c5ded2f1285e0887ef617ce58f82cf8b1838419ed700447ab68c5c73a4b7ad5eeb904eba17ab50d3220fe2d8721e3dfff1677a43664a162cd61
SSDEEP 24576:8T0aLl3z0zD+nQ/tbw/2Mkjy6Fr7g0oQ:8TDLlj/Q/lFTjN4
TLSH
T1607501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 8aa4c093e7a78119d575dc57714e133b394875ac8d82f172137ba7666006af3d
MD5 70f68af13e85a4140c2b15ad57155f4a
SHA1 2a84ea87761edb78ce2de0a077df6c0831ebb4db
SHA512 8427de2756b386aab01661609a0c6069e434e079b168775d6d1466d8854d32470de256c2977eed50abb5592ec0010b4904266099116626a0ea762aa35c58581a
SSDEEP 24576:j31d9CHKy7GZanQ/tbw/2Mkjy6Fr7g0o1:D1d9CHKyaIQ/lFTjN4
TLSH
T1B285CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 f5685f174ca556afa1965e333631ee483989b77f2f0edee9c9dec3965d177991
MD5 222b2e7105737d9e232becb90678e5f9
SHA1 324b5d44304335fbe7dfe9c98ff3caff92cc264d
SHA512 451dd9fad7357534993aff5d3e66f9381455a1d5f4604729f55d4247c58eaeb8dc0062d8da68b93263caec2cd70b0d024b6651f8fdcffcdeb8bf5bcf520220c0
SSDEEP 12288:wuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:wunQ/tbw/2Mkjy6Fr7g0o9
TLSH
T1435523697925F98BFB1706F54C828182AB3B0EC6BFD1938F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 4905373d497ef74604e51d6b6687a7d3ab72d1357621dc902b2cff63a0460efb
MD5 983d51b6693d234d0ca1643b3c763458
SHA1 4a50e001b5139d04c99c8f22831307de56c9e15d
SHA512 62a4f81ed3b2270101b125a9e967e544dddcb6e7519fe981b42f1a89e08cc09d5cc46b491c079374803b4dca2e91e36319ba37d9f78dc1050cea12d91c53d0d9
SSDEEP 12288:MwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:MQnQ/tbw/2Mkjy6Fr7g0od
TLSH
T16E5523783964F99BFA1B06F55C828142AB3F0EC6BFD1938F7B481129967D39406D63C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 1711fe516b2f75e184a6e1f12b1cfec097b1754af7e45752dd0232c9d83b5e6d
MD5 0480032a81515cb07c372cf36b15cb7f
SHA1 8a24c004d4ebb901fdc5dea4fe4860056fead88d
SHA512 858ad8e03fd41028f8046e435d29aaceeafff00ed9dd7ef1ee8d02c49633eb4a04970ee9660156e628c2a3ed03ffeb234653c8f11b7273bb2f3e5089f2f4c375
SSDEEP 12288:unGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:uHnQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T1F85523697925F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 e9edcf4686c9bc3190fb305de6a8bd654fd17bf4a46ab87e8328ff0e0e537041
MD5 21e037c8bce866882e10ae1b36c76ec0
SHA1 76d4bd2304a2f8949832aed6eefeb140e65971dc
SHA512 317659f6d9dc896fa36d70756e1ebfbf9bce76dfb0132f6156d261fa00630302222f8a669cb8d1d23a1fa3a710d2a39c1dea7becc4d7c76599a26195919d621d
SSDEEP 12288:8FGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:8lnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1615523697925F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 7039267b42a50d51f7812694797b110fca64433812081a2586419c05baa4954f
MD5 3cefc8b30f7eeda1595c61bf867e45cf
SHA1 39a364b18fa4a76b6917e6f05f71f672464ed8be
SHA512 052ebc318b11cee40fcd1c980ebf98416aec3d9f5156db5872e7144f020de7153106ddfb428a8ac8bcb14228b3d1c17fe671db3011fa692d59eb03ce88e58689
SSDEEP 12288:WuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:WunQ/tbw/2Mkjy6Fr7g0oh
TLSH
T1F55523697925F98BFB1706F14C8281829B7B0EC6BFD1938F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 6991e1b20dfb809a0fd462729aeab21657077e1252432f0df4e6ad6f48c58d94
MD5 1573f59d650a44f9333917f44a3a644c
SHA1 7aa1ecdbb20e7de06dd076167e7ae36d45c4f6b3
SHA512 02c4e17ce44ebbc9686d2d3aeb717fa7df96ccb8e36ec28a4cd354049e20abe9007022c5010eb2820582074a7815c84524bf3adc6eb7288069b4031336e09cec
SSDEEP 12288:vtGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:vNnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T1C15523797964F98BFB1706F14C8281429B7F0EC6BFD1A38F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 9e56c921c81bd7785c63035ecbf5ec5878b62e7d00da5a54a677a583836802ae
MD5 d837ae6bf0850d8a820f3fb3c3679092
SHA1 05ac9758adb055b0a16219104bc3c691a1978f86
SHA512 3e819f1f727c57c64211286ffc86616c1b50c7638370564bd10473172a94aaa79194bb6865e84c2692d2a10f7267380f8ed8a6e83ee13033ccf26c59ff8eff18
SSDEEP 12288:TbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:TLnQ/tbw/2Mkjy6Fr7g0oE
TLSH
T1BB5523697925F98BFA1706F14C828182AB7B0EC6BFD1938F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 ae06e8f4710e1d28605b454e67bed155eb131aec0abca47a9a5c4a802223008c
MD5 0d9ef3054215e571644a8c325e4ef0ac
SHA1 23307a32c6123173ce98525c798c40c600d53256
SHA512 e684d29af4390a24be66998a01c2b36aa393d57cf2e4bd94536f7b2b8295b85b2cd481381b58d22f26fd135ec9cfa39a7e43d51d9ecd22a974f6ff7d20e85c84
SSDEEP 12288:FmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:FGnQ/tbw/2Mkjy6Fr7g0oS
TLSH
T1465523697925F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481129967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 32f772ad01f096cb893c4805f83b033bc50d4d575bd734e216f304ac0676c0cd
MD5 7e5579c1ed78ee4c1da05ddd99c76059
SHA1 dfca5195ef4402d23b5e584a7b6eff2d8d593722
SHA512 4d72bea2da97226d967723c064d4ff512ef30f5bf5c688528be1a162f5fd1d400c9da703629abe4b2f041cc0e44d7af1465513809b0f2cf90c153c6ec69696c5
SSDEEP 24576:Mfwv/k9RX6wkyAI5nQ/tbw/2Mkjy6Fr7g0ou:7MnYI5Q/lFTjN4
TLSH
T10B85DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 468043370386b554b30c5005d4318e10dc8d8f9a9dc495f378869a46b0540a9d
MD5 e8c49aadb03e479854196b9fbcb7a31d
SHA1 7dddc6f1ae0ff118b97a86303787172dacc4f9e5
SHA512 d33d2b8ec43e8d9c4a34725dcf5f0794911c157d02c326419b95d6437c14500ec1957aabc19c72ca982259c5874e00bdcbd0c717535bedf8caff6d2d906e8937
SSDEEP 49152:/YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0iQ/lFTjN4:7ySzPVLm
TLSH
T19F066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 015afbe116b940b565a04fbb351a838a162c267f790460147fbf5980900dfbd8
MD5 56a410a78955da2575cb36a23297b672
SHA1 9d4acefb125c5810ddc550eb5a0fab9a483049fe
SHA512 f2cae09d512fded6a913cc2fa99d4a5b9ccad6077a5cc1a628fac2d4e0946b4306ed5a0f6db3eea36c85d550076c610a294c3ed808efb9be746535f934eb0d97
SSDEEP 24576:647Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYMnQ/tbw/2Mkjy6Fr7g0oy:647JUQj1irIhCnDHUPfF/yQ/lFTjN4
TLSH
T14965AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 11b9d8ec1939baef3f8d7760d63310e86074df0079e82d0a4fadd71f61aace17
MD5 a2f54ea67c87b4cbed74a7e6ff66d3b0
SHA1 45ee43af88d14044c09bfb1e5b8af36a95b5121b
SHA512 6e79abd1f1e2fcb442387609d3da9c2026a7a2c157ff408d9b939651f8e092d14c0b4633569bd5e84efba90d7569dc0fa1d16905004e2cf9ead69b186e744add
SSDEEP 12288:Qssf1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:eVnQ/tbw/2Mkjy6Fr7g0ow
TLSH
T11765F119E29852E9D02E1279CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 1aafc4dc3df975d845e03a5d995a77127688cae8e4f5d5c5acb887a4b02297a3
MD5 aaf73ed9a0dd64da92c8b390e77b55a8
SHA1 535604eb62b284e406c973b52ece7a9e3e6a79bd
SHA512 6bbc9274b2bcef148bc4be702a82ea189b5bc490cf036ff6036815564d072f3a8fa10039a99dd1ebb456a1bbe6342e5554106beea8b24939a5febccd3e15a43f
SSDEEP 12288:xjcf9y5nfxkjNZGfg7DYLKQ2SBN4MC1vUpARM16dbwCz:xK9EkhZi89Q2ENLC1spARMEu
TLSH
T135552850762BC75FC6A940325E32D2CCAB707D05EE456F0373C8873FD576669BAA2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 084647fed16872b824ec5f2ddb86774aea8b4d0cf8f8c63b24e8cb4947f51e1d
MD5 9a4859d3b89502f7b80eef2b3ff0d95f
SHA1 e92f29b3ff4bbb62378a1bdc91ae5df535acfd33
SHA512 7ca379574ee6e8a59b1e5b1c0d66022b4b6dcd95b03f807ce1fec91328909d6078e8c5d54b385f23165433edf798eaf6ac23b04f6f7315f0a9545aa00c0c6c76
SSDEEP 12288:NfE4u0p5AeACdImbvAjkA2iCcAvA8AGAFAHB/iAiT2t:gmjn/eC
TLSH
T1CC65F9815137A38FD5FB60720729AB8DA774EC06B7056F26B3C8053AD86A715B0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 8e7f3fd37441dc2d35165d4b5672fd4439ccc79629b0cc29c287fe012958aaee
MD5 293c5c1a99fbf7c3d579333a81411979
SHA1 19db776c12ae123fb423c02275f3086a75f6d203
SHA512 bffe248b99afae84a6b2a519b720b644de3462a2b35ac44aa2ad1069993d8fbba7daad628fc11c311872fe030ac375005ecf76f205c6d685fdf12831b8193364
SSDEEP 12288:h67dGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:o9nQ/tbw/2Mkjy6Fr7g0ok
TLSH
T1975523796668F94BFA3B06B058828111673F0EC5AF90D3CFBB082269957D3D40EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f42d896224bdd93494e32bbf93abc90d905b2587593f24f8cc243074d2b4361e
MD5 55c75ba21e5d4bc3e80e6fd5b2ade768
SHA1 3504f69f3dd45500a6b2f44d99e46088763b3983
SHA512 b5ac580166a9ab89813b3071e21e0b7ebd30dec638d9b17da39523eb2f0ac43cbf4b8ca69fcfc6702086f355bc65ea1f991f06daa993c4f8deeb4eafa742d680
SSDEEP 24576:lgb6bmBIi49WNNFpg1rSvFv7bY/nQ/tbw/2Mkjy6Fr7g0o5:lgb4mBIBhGFMQ/lFTjN4
TLSH
T1EE65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 b6018624ef98e2ebe1f9c6f02a537f2f9735b4215ad11254b422cc4c60a5347a
MD5 81100f68a652ba5fbab20e1dc89e990f
SHA1 5aaee661f35c5438ae97233dcfdac4e6237dacfc
SHA512 c3107efaa613e1debd3f64ad54a15369abd099b92a8f005fa92b6d5f17defd2dc72c7d0ca100aa5f1d1b77f99f3d2f3234ca606baf33137072086f0b835aceda
SSDEEP 24576:CG88u8FpJqH1Qzria7/m8nQ/tbw/2Mkjy6Fr7g0o+:Z7ZFPqVva7/nQ/lFTjN4
TLSH
T13085F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 c9e2a81ce6055d6a753ffec6058d8d83dd451ff63fef57728e2f8feefc4da2f9
MD5 934bb4963179ce3dc099b8f17a484e1b
SHA1 2dbcaaa607cec51988350b65c1f27c1bd4ff610f
SHA512 a0e3345f4c01b4979a07587fc2feb9f59c30c57e9cce151eb85983256d179358234c088f595f0ab0b2d51f889b023a79f02704d62eca1bef0d9d2776dd3dd3cd
SSDEEP 12288:DHvUrBFrEjwaQIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:DPUr+NQInQ/tbw/2Mkjy6Fr7g0oI
TLSH
T16465E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 3750fecc6981e2060a29eb1925fd5638ff6430d175e6989a24aedeccd899f70d
MD5 51e0147510331f30e7b65d34861183a7
SHA1 bb5cf0be1abcdea2fd056a3f0277bccf07c129f1
SHA512 4ba5ffd9799bf72cc90e3fece2e8da3f9dd4b4a62ce473ec3b14ea8b339cd86552e67b7d70f26da1eaf82c2680ac28b20e60fcb5e24588834de3b3c7148b0c4e
SSDEEP 49152:iBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj4Q/lFTjN4:tG05lO43bmLm
TLSH
T1F0D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9f8a96a0fc365e2de3f395dd73ae3069910a78e4b50d5d9b8a1da2779cc83838
MD5 2102121915f9845c359223cef20f35c3
SHA1 a4a1edc4c095ade7ffe60dcf5aa4d669eb8a0f55
SHA512 5faffaf6d845b4312a75bda33d41243a0fe5db75f5a272fffd8d4e141391e14e873f8b63d93b99e7437544ec3f35cd37dd2f469d00732f560e6f7524ff5a1fbf
SSDEEP 24576:Efa5POZ3dpFWVM50JicR2hG0lasx2+47eidninQ/tbw/2Mkjy6Fr7g0oF:ca5POZ3+Jt2pasx2+mQQ/lFTjN4
TLSH
T12565AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 156a9f3ed383b94daa5d01de29741bde9e39a813b72a68b4a2cff6ffac9ff4b4
MD5 73810a8a3e532d491ae7a2671df993f2
SHA1 6bd1537f6357c88ee324c9f30190d47fbbe99e61
SHA512 9dee5dc55c3f92ab7cb0f61cee4d441126cea2ae1be4e77c73d101b81e60fb5634bfbc1db241e16ffc7fb0826d21a6f22342c1eaccce5342dd296f784b223e6d
SSDEEP 24576:PNcwHdjbyQ4nLC18lb/EOjowL7FkUnQ/tbw/2Mkjy6Fr7g0o+:PNc/zEOVHFHQ/lFTjN4
TLSH
T10A858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 275ff873997954df22bfc897876931b2b82e65b7de6c2ff85128ae51a6979ede
MD5 552fae907adb9721f6f157cbf0878e60
SHA1 77ea62060435a758b7bbf72427bd269c1726a6d2
SHA512 e2c8dcdd127b866f45aa1452c527da2bbd435f1b41cb545c8dd3e87a9190f8557cfba5bf282164f7da1bbfe48778eea182f59501916d97759c0b5d8688cc641b
SSDEEP 24576:z8kNvNnaFeYhJNtmZBmGnQ/tbw/2Mkjy6Fr7g0o1:z8MwBtOmGQ/lFTjN4
TLSH
T16955AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 2d1182f3571bc94bf36901bf2f33c055d6583615d472d319739b73ae3c279259
MD5 3cdabf5c88b75238ff5b69cf22a21dfc
SHA1 05310d836c7e125c242cf9bc8d1ec09a5da5e617
SHA512 ab34eb7138c057ccc06645dcb291ad9e2305e03f9d6518e555f693569756fc2e363913748c5029177fda263cfbfa9eb0dcb7c009114e1630c22e02265b3ded30
SSDEEP 24576:ND3FHshBIYQgARnQ/tbw/2Mkjy6Fr7g0o0:NDVHeBIAARQ/lFTjN4
TLSH
T1AE75E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1476-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1476-14-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1476-22-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1476-111-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2092-49-0x0000000002380000-0x00000000023E0000-memory.dmp

Download

memory/2092-51-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2092-38-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2092-39-0x0000000002380000-0x00000000023E0000-memory.dmp

Download

memory/2092-45-0x0000000002380000-0x00000000023E0000-memory.dmp

Download

memory/3016-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3016-106-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3016-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3016-313-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3016-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3084-66-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3084-64-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3084-72-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3084-294-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3100-112-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3100-114-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3100-312-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3100-120-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3748-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3748-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3748-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3748-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4384-88-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4384-94-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4384-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4384-383-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4384-381-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4384-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4420-82-0x0000000000990000-0x00000000009F6000-memory.dmp

Download

memory/4420-76-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4420-309-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4420-77-0x0000000000990000-0x00000000009F6000-memory.dmp

Download

memory/4880-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4880-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4880-124-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4880-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4880-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5304-137-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5304-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5304-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5304-132-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5456-54-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5456-60-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5456-53-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5456-281-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/6032-86-0x0000000000400000-0x00000000007F1000-memory.dmp

Download

memory/6032-0-0x0000000000400000-0x00000000007F1000-memory.dmp

Download

memory/6032-323-0x0000000000400000-0x00000000007F1000-memory.dmp

Download

memory/6032-1-0x00000000025B0000-0x0000000002616000-memory.dmp

Download

memory/6032-8-0x00000000025B0000-0x0000000002616000-memory.dmp

Download